CVE-2018-1479

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 140761.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
IBM	BigFix Platform	9.2; 9.5

References

http://www.ibm.com/support/docview.wss?uid=swg22015754Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/140761VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22015754Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/140761VDB Entry, Vendor Advisory

Timeline

Published: Apr 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-147909.8Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. A buffe CVE-2018-147917.8Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable and library files on CVE-2018-147926.3WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project files.CVE-2018-147938.8DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable to a buffer overflow exploit through an open communication port to allo CVE-2018-147949.8Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. The device does not perform a check on the length/size of a project file before co CVE-2018-147958.8DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace CVE-2018-147967.5Tec4Data SmartCooler, all versions prior to firmware 180806, the device responds to a remote unauthenticated reboot command that may be used CVE-2018-147977.8Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded CVE-2018-147985.3Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. The pro CVE-2018-147993.7In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize dat CVE-2018-14805.3IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cook CVE-2018-148007.8Delta Electronics ISPSoft version 3.0.5 and prior allow an attacker, by opening a crafted file, to cause the application to read past the bo